https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404141#M6463 <P>Thank you pkeenan87. it really helps.</P> Fri, 22 Feb 2019 01:08:17 GMT splunkbeginner 2019-02-22T01:08:17Z https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404139#M6461 <P>I have specified the following variables to extract from my Symantec DLP system and send them to Splunk. </P> <P>Message = ID: $INCIDENT_ID$, Policy Violated: $POLICY$, Rules: $POLICY_RULES$, Count: $MATCH_COUNT$, Protocol: $PROTOCOL$, Recipient: $RECIPIENTS$, Sender: $SENDER$, Severity: $SEVERITY$, Subject: $SUBJECT$, Target: $TARGET$, Filename: $FILE_NAME$, Blocked: $BLOCKED$, Endpoint: $ENDPOINT_MACHINE$</P> <P>The following are the search results using the “sourcetype=symantec:dlp:syslog”</P> <P>Feb 21 09:39:11 192.168.1.5 Feb 21 09:40:23 ABCcompany Message = ID: 97712, Policy Violated: IT-IDM-Policy, Rules: [UNKNOWN VARIABLE: POLICY_RULES], Count: 3, Protocol: Endpoint Removable Storage Device, Recipient: N/A, Sender: N/A, Severity: 1:High, Subject: N/A, Target: N/A, Filename: Confidentail2.txt, Blocked: None, Endpoint: PC_David</P> <P>Feb 21 09:43:48 192.168.1.5 Feb 21 09:46:23 ABCcompany Message = ID: 97713, Policy Violated: IT-IDM-Policy, Rules: [UNKNOWN VARIABLE: POLICY_RULES], Count: 3, Protocol: Endpoint Removable Storage Device, Recipient: N/A, Sender: N/A, Severity: 1:High, Subject: N/A, Target: N/A, Filename: Confidentail.txt, Blocked: None, Endpoint: PC_David</P> <P>Feb 21 09:43:48 192.168.1.10 Feb 21 09:46:23 ABCcompany Message = ID: 97714, Policy Violated: HR-IDM-Policy, Rules: [UNKNOWN VARIABLE: POLICY_RULES], Count: 3, Protocol: Endpoint HTTPS, Recipient: Unknown, Sender: 192.168.2.122, Severity: 1:High, Subject: N/A, Target: N/A, Filename: N/A, Blocked: None, Endpoint: PC_Ryan</P> <P>I would like to create a pie chart comparing number (better with percentage) of policies violated; which should be 2 IT-IDM-Policy (66%), and 1 HR-IDM-Policy (33%).<BR /> I have extracted a field named “Policy_Violated” by regular expression ^(?:[^:\n]*:){6}\s+(?P[^,]+). And the results are expected as follows:</P> <P>Values Count %<BR /> IT-IDM-Policy 2 66.6<BR /> HR-IDM-Policy 1 33.3</P> <P>But then what search keywords shall be used in order to generate statistic or visualization results which can be used afterwards to create a pie chart?</P> Tue, 29 Sep 2020 23:24:06 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404139#M6461 splunkbeginner 2020-09-29T23:24:06Z https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404140#M6462 <P>Try this search:</P> <P>sourcetype=symantec:dlp:syslog | stats count by Policy_Violated</P> <P>Here is a link to all the cool stuff you can do with the stats command: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Stats">https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Stats</A></P> <P>I also suggest specifying an index in your search to limit the scope, something like this:</P> <P>index=&lt;&gt; sourcetype=symantec:dlp:syslog | stats count by Policy_Violated</P> Thu, 21 Feb 2019 14:24:16 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404140#M6462 pkeenan87 2019-02-21T14:24:16Z https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404141#M6463 <P>Thank you pkeenan87. it really helps.</P> Fri, 22 Feb 2019 01:08:17 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-generate-statistic-or-visualization-results-for-Splunk/m-p/404141#M6463 splunkbeginner 2019-02-22T01:08:17Z